PDPL Data Localisation for Health SaaS: What Saudi Hospitals Should Ask Before They Sign

What the draft amendments actually propose

In early October 2026 SDAIA published draft amendments to the PDPL Implementing Regulations for public consultation on the Istitlaa platform, open from 6 October to 5 November 2026. According to Clyde & Co's summary, the draft would introduce a new Article 23 requiring controllers to store personal data within Saudi Arabia, while transfers and disclosures abroad would remain possible if they comply with the PDPL and its Implementing Regulations.

Three other proposals matter to a hospital buyer. Under Article 34, registration on the National Register of Controllers would become mandatory for controllers that transfer or disclose personal data outside the Kingdom, which could capture cloud and outsourcing arrangements. Under Article 24, breaches would have to be notified to SDAIA within 72 hours of awareness, without the current harm threshold. And a new Article 18 would require privacy policies to match the language customarily used with data subjects, which for most Saudi hospitals means Arabic.

Two cautions. This is a law-firm summary, not the draft text, so read the official consultation document before you rely on any detail. And at the time of writing we have not confirmed whether SDAIA has adopted the draft as published or revised it. [VERIFY WITH BRAND]

What is already in force on cross-border transfers

You do not have to wait for the draft to ask transfer questions. SDAIA issued Regulations on Personal Data Transfer outside the Kingdom on 1 September 2024. As summarised by Mayer Brown, a controller that transfers personal data abroad must rely on one of three safeguards: SDAIA's standard contractual clauses, binding common rules for multinational groups, or a certificate of accreditation. The standard clauses come in four versions (controller-to-processor, controller-to-controller, processor-to-controller and processor-to-processor), cannot be modified, and cannot be used where the recipient country's laws prevent the importer from complying. A transfer risk assessment is required when a safeguard is used, or when sensitive data is transferred on a continuous or widespread basis.

Health data is sensitive by nature, so a hospital that lets a vendor move patient data abroad, even for support or analytics, should assume the transfer-risk-assessment question applies and confirm this with counsel.

Why a health platform is a different procurement problem

Law firm commentary on healthcare outsourcing is consistent on one point: outsourcing does not transfer responsibility. Al Tamimi & Company notes that providers will "almost always" be treated as data controllers even when third parties deliver cloud or AI tools, that data processing agreements should address incident response, sub-processing and audit rights, and that providers should know where data is hosted, who can access it, how backups are handled and whether localisation requirements apply to specific datasets.

Cloud hosting adds its own layer. Morgan Lewis (March 2026) describes a regime in which cloud providers register with the Communications, Space and Technology Commission and receive a Class A, B or C designation that determines the data classifications and sectors they may serve, and in which clients commonly expect Arabic or bilingual contracts, SLAs denominated in Saudi riyals and onshore support. Which of those expectations bind a given hospital depends on its ownership, its sector regulators and the datasets involved, so treat them as questions to ask, not assumptions to make.

Seven questions to put to any health SaaS vendor

1. Where do production data, backups and logs physically sit?

Ask for the hosting country and provider for each of the three. A vendor that says "in the Kingdom" for the database but is silent on backups, observability logs or analytics stores has answered one-third of the question.

2. Who can access patient data, and from where?

Location of storage is not location of access. Ask whether engineers or support staff outside the Kingdom can view identifiable records, under what approvals, and how access is logged. Remote support access can be a cross-border transfer in its own right; confirm with counsel.

3. Which sub-processors are involved, and where are they?

Request the current sub-processor list (messaging providers, SMS gateways, email, analytics, AI services) with country and function, plus a commitment to notify you before changes. Messaging channels are the usual blind spot in patient-engagement platforms.

4. What transfer mechanism applies if anything leaves the Kingdom?

If any personal data leaves, ask which safeguard is used (standard contractual clauses, binding common rules or accreditation), whether a transfer risk assessment exists, and whether the vendor or hospital must register on the National Register of Controllers if the draft is adopted.

5. Can the vendor support a 72-hour incident clock?

Even as a draft, the 72-hour proposal is a useful stress test. Ask for the vendor's detection, escalation and notification commitments in hours, the named contact, and how sub-processor incidents reach you.

6. Are consent flows and privacy notices available in Arabic?

Draft Article 18 points to notices in the language customarily used with patients. Confirm the vendor can deliver Arabic notices, consent capture and withdrawal inside the patient journey, not as a PDF link.

7. What happens at exit?

Ask for export formats, deletion certificates, backup purge timelines and how long the vendor keeps copies after termination. Exit terms are the cheapest protection to negotiate and the hardest to add later.

An illustrative scenario: a five-branch hospital group

Illustrative scenario, not a client case. A five-branch private hospital group in Riyadh, Jeddah and the Eastern Province is choosing a patient-engagement platform. Procurement receives two proposals. Vendor A states "hosted in the Kingdom". Vendor B lists the production database in-Kingdom, a messaging provider and a support desk in other countries, and offers SDAIA's standard clauses for that flow. Vendor A looks cleaner on the cover page, but when the hospital asks the seven questions it turns out backups and logs sit elsewhere and no sub-processor list exists. Vendor B's answers are more complicated and more complete. The group's data protection lead can document Vendor B's flows, complete a transfer risk assessment and decide whether to keep the messaging flow offshore or require an onshore alternative. The lesson: a precise answer beats a reassuring one.

How CareSync approaches hosting and documentation

CareSync is a white-label omnichannel health-tech platform for hospitals, clinics and pharma programmes. For hospital buyers we can provide hosting location, sub-processor list, data processing agreement and Arabic-language notices as part of due diligence. [VERIFY WITH BRAND] The exact hosting arrangements, sub-processors, certifications and transfer safeguards for each product must be confirmed by the CareSync team before this section is promoted; do not quote them externally until they are.

Frequently asked questions

Q1: Does the PDPL require patient data to be stored in Saudi Arabia?

A1: Not as a blanket rule in the sources we reviewed. The draft amendments would add an in-Kingdom storage duty for controllers (draft Article 23) while still permitting lawful transfers abroad, and sector or cloud rules may apply to specific datasets. Confirm the position for your hospital with counsel before relying on a general statement. [VERIFY WITH BRAND]

Q2: Are the draft PDPL amendments already law?

A2: No. They were published as a draft for consultation from 6 October to 5 November 2026. If approved, they would take effect 60 days after publication in the Official Gazette. Check SDAIA's official channels for the current status.

Q3: Can a Saudi hospital use a SaaS vendor that hosts data outside the Kingdom?

A3: Transfers abroad are possible under the 2024 transfer regulations if the controller relies on a safeguard such as SDAIA's standard contractual clauses, binding common rules or accreditation, and completes a transfer risk assessment where required. Whether a particular arrangement is acceptable for a particular hospital is a legal question. [VERIFY WITH BRAND]

Q4: What should a data processing agreement with a health SaaS vendor include?

A4: At a minimum: alignment with the PDPL, cybersecurity and incident-response duties, rules on sub-processing, audit rights, and, for any transfer abroad, Saudi-aligned standard contractual clauses and a documented transfer risk assessment.

Q5: What does the proposed 72-hour breach notification rule mean for vendors?

A5: Under the draft, controllers would notify SDAIA within 72 hours of becoming aware of a breach, regardless of likely harm. Because your hospital is the controller, your vendor contract needs a faster internal clock, with named contacts and sub-processor escalation.

Sources

• Clyde & Co, "The SDAIA publishes draft amendments to the PDPL Implementing Regulations" (October 2026)
• Mayer Brown, "Updates to Saudi Arabia's Personal Data Protection Regulations: SCCs, Guidelines and More" (9 October 2024)
• Morgan Lewis, "Saudi Arabia Cloud Compliance Part 1: Data Residency and Contractual Expectations" (27 March 2026)
• Al Tamimi & Company, "Cloud, AI, and Healthcare Outsourcing in Saudi Arabia: Building Regulatory Readiness"

This article is general information, not legal advice. Confirm requirements with qualified counsel and the official SDAIA texts.